Re: Capabilities interact nicely with Substructural Types and Reactivity

On Sep 12, 2013, at 7:51 PM, Mark S. Miller wrote:

> On Thu, Sep 12, 2013 at 3:55 PM, Jonathan Rees <[email protected]> wrote:
> What David Barbour makes perfect sense to me, and I think some of you are being just a bit condescending.
> 
> No condescension intended. If I expressed any, my apologies.

I didn't say who I had in mind... & did not mean any serious chastisement.

> I am challenging David's statements because I am trying to understand them. Until I do, it *sounds* like he's saying in effect that E and Joe-E can't do well (without selling out) things that I think it does do well (support determinism and confinement). 

> In W7 (1994), 'new' and mutation (it called them 'lambda' and 'cell-set!') were capabilities that had to be passed to code in order to be available; they could be attenuated, etc. I thought that was a nice feature, for reasons similar to what David has given.
> 
> I do not yet understand those reasons. Echoing Alan, could you give an example of a *security* benefit that follows from being able to attenuate those?

I hope you will forgive me if it takes a few days for me to respond; your questions deserve a proper reply and I think I need to (a) do my day job (b) do some reading on this (c) catch up on the thread... but in the mean time, perhaps you can help me out with this question: Suppose I come up with a benefit B, how do I tell whether B is a security benefit or not? That is, how can I pre-test whether an answer I might come up with will be a good one? (not a challenge, just a question.)

I think it's a pretty interesting question.

Jonathan